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-(U//FOUO) NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER BULLETIN 

Details On "Anonymous" Upcoming US Operations: 17 September 2011: Occupy Wall Street; "US Day of Rage 

-(U)- Anonymous has come out publicly supporting a 1 7 September 201 1 protest on Wall Street, 
originally announced by the group "Adbusters" on 1 3 July 201 1 . According to the Adbusters 
Website, it hopes to motivate 20,000 Americans to congregate on Wall Street. Similar acts are 
emerging targeting financial districts in Madrid, Milan, London, Paris, and San Francisco during 
the same timeframe. The Adbusters are coordinating logistical activities and news distribution 
for Occupy Wall Street using their public facing Web site, OccupyWallSt.org. 

4U)-The Anonymous YouTube USPER video uses information from the Adbusters' "Tactical 
Briefing," calling for protestors to adopt a nonviolent "Tahrir-acam pad as model." The call is for 
members to "flood into lower Manhattan, set up tents, kitchens, peaceful barricades and occupy 
Wall Street for a few months... Once there, we shall incessantly repeat one simple demand in a 
plurality of voices." 
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-(Uf According to their public Web site, Adbusters publicly stated its intent to conduct nonviolent 
protests to "demand that America's resources be invested in human needs and environmental 
protection instead of war and exploitation." 

(ii) Adbusters is also scheduling an upcoming peaceful protest targeting the Washington, DC 
National Mall in October 2011, which is motivated by the 1 0th anniversary of the invasion of 



Afghanistan and the beginning of the 2012 federal austerity budget. 




4U)-Poster for "US Day of Rage" protest 




(U) Comments 



(U//FOUO) The ideologies set forth by Adbusters seem to align at a basic level with the stated intent of 



Anonymous' newly adopted Hacktivist agenda. The protests are likely to occur due to the high level of media 
attention garnered by the partnership between Adbusters and Anonymous. Though the protests will likely be 
peaceful in nature, like any protest, malicious individuals may use the large crowds as cover to conduct illegal 
activity such as vandalism. Judging based on past behaviors by the group, Anonymous' participation in these 
protests may include malicious cyber activity, likely in the form of distributed denial of service attacks targeting 
the computers of financial institutions and government agencies. 
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"ANONYMOUS 91 Upcoming US Operations, Impact, and Likelihood 

-£U}-The loosely organized hacking collective known as "Anonymous" has announced through several 
mediums that they plan on conducting cyber attacks, peaceful protests, and other unspecified activity 
targeting a variety of organizations. 

UO} Occupy Wall Street: NCCIC assesses that it is likely peaceful protests will occur on 
Wall Street on 17 September 201 1. These protests may be accompanied by malicious cyber 
activity conducted by Anonymous. 

__ (ll//FOUO> Operation FaceBook^ PER : NCCIC assesses that it is unlikely that a coordinated or 
sophisticated cyber attack will be conducted by Anonymous (at large) targeting FaceBook.com on 
5 November 201 1 . However, there remains the possibility that low-level or lone-wolf attempts 
may occur. 

— (U//FOUO) Project Mayhem: NCCIC assesses that a combination of inconsequential physical 
mischief and potentially disruptive malicious cyber activities will be conducted leading up to the 
culmination date of 21 December 2012. At this point, specific tactics, techniques, and procedures 
(TTP) are unknown. 

(U//FOUO) Operation Halliburton: Little is known about this potential upcoming operation. 
NCCIC assesses that targeting US corporations is consistent with past Anonymous targets. 
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(U) Comments 





rt/ng regarding Anonymous and its plans targeting 



(U//FOUO) The NCCIC continues to monitor open source 

organizations and will report to the broader cybersecurity community if new information becomes available. The 




NCCIC is coordinating with individuals and organizations in the cybersecurity, intelligence, and law 
communities to monitor and report on the development of new tools and TTP by Anonymous and other organizations. 
The NCCIC is coordinating with the financial sector and other critical sectors to monitor threat activity and will provide 
further updates in the form of alerts, advisories and bulletins, as appropriate. 
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j(U) Hacker Group Anonymous Threatens New York Stock Exchange 



— (U)-ln a 2 October 201 1 video message posted on a YouTube USPER channel 
associated with the hacker group, Anonymous declared "war" and threatened to 
"erase" the New York Stock Exchange (NYSE) USPER from the Internet on 10 
October 201 1 . The threat was not explained. 

-(U) It is likely the group is referring to a distributed denial-of-service 
(DDoS) attack on the public-facing NYSE.com Web site. 

— (l l)- This type of activity would be similar to DDoS attacks the group has 
used to take down Web sites in the past and would not cause significant or 
lasting damage to the NYSE or its ability to operate. Others speculate that 
Anonymous may go beyond a DDoS attack on the NYSE.com and may 
attempt to disable actual trading on the exchange. 

■(U)-On 4 October, some Anonymous members expressed on Web forums 
that the 10 October threat is fake and planted by law enforcement to step up 
action against the hacker group and turn public opinion against their cause. 



The Anonymous-associated YouTube channel has been used to post 





(ii) Anonymous banner on the 
"Occupy Wall Street" Web site. 



several "Occupy Wall Street" -related video messages, including some from 
Anonymous, since the protest against lax regulation of the financial sector 
and growing economic inequality began on 1 7 September 201 1 . 
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(U) Comments 



(U//FOUO) The US Computer Emergency Readiness Team (US-CERT) has notified the FBI, Treasury, and Financial 
Services Information Sharing and Analysis Center of the threat and remains in contact with law enforcement and 
private sector partners to ensure any additional threat information is disseminated in a prompt manner. To date, 
US-CERT has not received additional information concerning this threat from law enforcement channels. 
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